Security of Electronic Health Information
Sets the Agency’s security program for electronic patient information: the security official, the risk analysis and risk management plan, access control with unique logins, role-based access, automatic logoff, encryption, audit logs that record every change or deletion (Cal. Civ. Code §56.101(b)), mobile device rules for staff in the field, backups and a contingency plan, security incident handling, and the documentation the HIPAA Security Rule requires (45 CFR §§164.308-164.316), so that computerized records are protected as 22 CCR §74731(i) requires.
- Policy number
- CA-HH-PRV-02
- Version
- 1.0
- Main rule
- 22 CCR §74731(i)
- Library
- California home health · 58 policies
- Category
- Privacy
- Sections
- 21
In short
- Use only your own login. Never share your password or let anyone use your device.
- Keep patient information only in the approved app, not in your photos, texts, or personal email.
- Lock your screen when you step away, and never leave a device in a patient’s home or in sight in your car.
- If a device is lost or stolen, or you clicked a suspicious link, call the security official right away.
- If the system is down, document on the paper downtime forms and enter the notes when it comes back.
What's inside
21 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (22 CCR §74731(i))
- 5. Security Official and Risk Analysis
- 6. Access Control
- 7. Audit Logs and Activity Review
- 8. Mobile Devices and Working in the Field
- 9. Office Workstations and Media
- 10. Email, Fax, and Transmission
- 11. Backups, Contingency Plan, and System Downtime
- 12. Security Incidents
- 13. Vendors
- 14. Responsibilities
- 15. Records and Compliance Monitoring
- 16. Staff Training
- 17. References
- 18. Related Policies and Forms
- 19. Approval
- 20. Revision History
An inspector may ask
- Who is your security official? When did you last complete a security risk analysis?
- How do staff log in to the electronic record in the field, and what happens if a tablet is lost?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.